Article 29 GDPR — enforcement

Cited in 32 decisions · €13.7M total fines · median €40,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (11)

Date ↓	Company / party	Authority	Articles	Fine
2022-04-15	DEDALUS BIOLOGIE Insufficient technical and organisational measures to ensure information security	🇪🇺 French Data Protection Authority (CNIL)	Art. 28 Art. 29 Art. 32	€1,500,000
2022-04-07	Tecnomed Trento s.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 29 Art. 32	€10,000
2021-11-26	Valoris Center S.R.L. Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 29 Art. 32	€2,000
2021-09-16	Sky Italia S.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€3,296,326
2021-04-19	Lugera & Makler Broker S.R.L. Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 29 Art. 32	€1,500
2021-02-10	ING Bank N.V. Amsterdam - Bucharest office Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 29 Art. 32	€1,000
2020-07-13	Merlini s.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 28	€200,000

← previous 26–32 of 32